AI Security Interviews & Case Practice
Common questions with strong answers, a design method and a portfolio that proves your skill.
Interviewers look for threat-model thinking, knowledge of the main attacks and defenses, harm reduction by design and honesty about limits. Use a method: assets, diagram, threats, rank, controls, test, monitor, respond and limits. Show a threat model, an attack write-up, a regression set and an incident playbook.
- Defense in depth
- Using several layers, so one failure does not break everything.
- Attack set
- A saved list of attacks that you run on every release.
- Residual risk
- The risk that remains after controls.
This last lesson prepares you for the interview. Picture the hiring manager. They have seen AI features shipped with no thought for abuse, and they want a security person who is practical, not only fearful. They will test your threat thinking, your depth on the main attacks and your ability to work with engineers. This lesson shows common questions, a method and a portfolio.
What interviewers look for
- You think in threat models and trust boundaries.
- You know the main AI attacks and real defenses, and you know their limits.
- You focus on reducing harm by design, not only on filters.
- You can test and measure security, and respond to incidents.
- You can explain risks to non-security people, and you work with engineers, not against them.
- You are honest that no defense is perfect.
Common questions and strong answers
Question: how would you secure an AI assistant that reads a user's email and can send replies? A strong answer starts with the threat model. Email is untrusted input, so indirect injection is the main risk. The assistant should draft but not send without approval. Sending should be limited to approved recipients. Tools should use the user's permissions. Outbound links and images should be blocked. All tool calls should be logged. An attack test set should run on every release.
Question: can you make prompt injection impossible? A strong answer says no. Models do not separate instructions from data reliably. The goal is to limit the damage: least privilege, no dangerous pairing of untrusted input with outbound power, approvals for risky actions, checks in code, detection and testing.
Question: a customer reports seeing another customer's document in an answer. What do you do? A strong answer treats it as a serious incident. Contain first: disable the affected search or feature. Preserve logs. Find the cause, probably a missing customer filter. Tell legal and privacy about notification duties. Fix, add a two-account test and review the same pattern elsewhere.
Question: how do you measure the strength of your defenses? A strong answer uses a regression set of known attacks, run on every release. It tracks the share blocked, and also false alarms on normal requests. It adds new attacks from red teaming and incidents. It admits that the set cannot cover unknown attacks, and keeps human red teaming.
A method for open design questions
1. ASSETS What are we protecting: data, actions, identity, money, trust?
2. DIAGRAM Parts, data flow and trust boundaries.
3. THREATS Use the question list. Include injection, leakage, over-agency, supply chain.
4. RANK Likelihood and harm. Pick the top few.
5. CONTROLS Design out the risk first: least privilege, approvals, isolation.
Then add checks, filters and limits.
6. TEST Attack set, two-account tests, red team.
7. MONITOR What you log, what you alert on, who responds.
8. RESPOND Kill switch, playbook, drill.
9. LIMITS What remains, and how you accept or reduce it.Show your work
- Write a threat model for a small AI app, with a diagram, a register and tests.
- Build a tiny assistant, attack it and publish the findings with the fixes.
- Create a regression set of attacks and a script that runs it.
- Write an incident playbook and a short report from a tabletop drill.
- Share what you learned, including what failed.
Questions to ask them
- How do you review AI features for security before launch?
- What is the most serious AI incident you have had, and what changed?
- How do security and product teams work together on trade-offs?
- Which part of the system do you worry about most?
- ✓Interviewers look for threat-model thinking, knowledge of the main attacks and defenses, harm reduction by design and honesty about limits.
- ✓Be ready to secure an email assistant, explain why injection cannot be made impossible, handle a cross-customer leak and measure defenses.
- ✓Use a method: assets, diagram, threats, rank, controls, test, monitor, respond and limits.
- ✓Show a threat model, an attack write-up, a regression set and an incident playbook.
Answer a design question aloud
- Pick this question: secure an AI agent that browses the web and fills in forms for employees.
- Answer in ten minutes with the nine steps. Record yourself.
- Listen back. Mark where you skipped trust boundaries, approvals or limits.
- Write a one-page version with a diagram, five threats and five controls.
Q1Can you make prompt injection impossible?show answer
No. Models do not separate instructions from data reliably. Limit the damage with least privilege, approvals, code checks, detection and testing.
Q2A customer sees another customer's document. First steps?show answer
Treat it as serious. Contain by disabling the affected feature, preserve logs, find the cause, involve legal and privacy, then fix and add a two-account test.
Q3How do you measure your defenses?show answer
Run a regression set of known attacks and normal requests on every release, track blocks and false alarms, and keep human red teaming for unknown attacks.